/suxiaoqiang-cli

name: suxiaoqiang-cli
description: >
  Use suxiaoqiang-cli (sxq) to sync, edit, preview, release, manage allowlisted project plugins,
  install private plugin skills, and query Superun Cloud databases or logs from the terminal.
  Use when the user mentions sxq, suxiaoqiang-cli, a Superun sessionId, project plugin management,
  db query/logs/migrations, or explicitly requests a maintainer release of the CLI, npm package,
  plugin skill, or documentation. 当用户提到 sxq、suxiaoqiang-cli、Superun sessionId、项目插件、
  私有插件技能、数据库查询/日志/迁移，或明确要求发布 CLI、npm 包、插件 skill 或文档时使用。

suxiaoqiang-cli (sxq)

`sxq` syncs a Superun project (identified by a `sessionId`) with a local directory, drives the preview pipeline, and opens the browser for production release confirmation. In Claude Code and Codex environments, use non-interactive flags only after the user has authorized the exact operation. In particular, never add `-y` to `sxq push` before reviewing its add/modify/delete plan.

Prerequisites

• `sxq login` obtains a `sup_pat_` PAT after browser authorization. `SUPERUN_PAT` overrides the

saved credential for all API calls; with it set, login only validates it without opening a browser or saving it. Empty or malformed environment values fail explicitly. Manual PAT import supports hidden input (`sxq login --pat`) and stdin (`sxq login --stdin`), with online validation before saving. Existing `--token` credentials remain supported. Business PATs are separate from the domestic pre-release gateway `PRIVATE_TOKEN`.

• Browser-based `sxq login` requires a browser and must be done by the user. If any command reports

"Not logged in / 未登录" or "credential expired / 凭证无效", ask the user to run `sxq login` themselves — do not attempt it. Exception: if the user hands you a token, run `sxq login --token <token>` (it validates the token and keeps the previous credential on failure). Never ask the user to paste a token proactively.

• A project directory is bound via `.sxq/config.json` (created by `sxq link`). Check for it

before assuming a directory is linked.

• `sxq link` requires stage 2 (demo) or later. Complete style selection in Superun first;

a missing, invalid, or earlier stage is rejected before changing the local binding.

Core workflow

sxq link <sessionId> -y     # bind current dir to a project (verifies ownership; needs login)
sxq pull                    # pull remote files (incremental, three-way merge)
# ... edit files locally ...
sxq push -m "<summary>"     # review add/modify/delete plan, then confirm the push
sxq preview                 # update the frontend preview; equivalent to sxq preview front
sxq preview ef              # update only the Edge Function preview
sxq deploy                   # open the linked project's release confirmation page
sxq deploy --status         # read-only: pending/published versions + live URL

Command details & flags

• `sxq push [-f] [-y] [-m <message>]` — pulls first, then lists every added, modified, and deleted

text file before pushing. Git projects default to the project-level `push-branch` (`main`); `-f` ignores branch restrictions, while `-y` confirms the displayed plan without an interactive prompt. Only use `-y` after the user has authorized the exact push. Respects `.gitignore` plus built-in ignores (`node_modules`, `dist`, `.git`; binaries and files over 5MB are skipped). If it aborts with conflict markers (`<<<<<<< local`), resolve the listed files, then push again.

• `sxq preview [front|ef] [--message-id <id>]` — updates the preview environment. `front` is

the default and polls the preview build for up to 10 min; `ef` deploys all Edge Functions from the linked project's latest completed mainline version. `--message-id` only applies to `front`. The legacy `sxq publish` command remains available for compatibility, prints a deprecation warning, and then runs the same behavior as `sxq preview front`.

• `sxq deploy` — opens the linked project's release confirmation page in the user's browser.

It never calls the release API directly. The user must review and confirm the release on the page; agents must not claim that a release happened just because this command exited 0.

• `sxq pull [-f]` — local-only edits are preserved via three-way merge. Git projects only operate

on the configured `push-branch` by default and apply the shared local-file safety checks before writing the worktree. Conflicted files are listed and contain git-style markers; resolve before pushing. `-f` only ignores configured/manifest branch restrictions.

• `sxq config set|get|unset|list` — keys: `host` (API base URL), `lang` (`zh`/`en`), and the

project-level `push-branch` (defaults to `main`).

• The CLI reads npm dist-tags on the first command each day and uses its local cache afterward. If

the installed version is below the maintainer's `required` tag, it upgrades itself through npm and then re-runs the original command with the new CLI. `sxq upgrade`, `--version`, and `--help` remain directly available. A cached mandatory policy remains enforced during registry outages.

• `--debug` on any command prints full request/response logs (tokens masked) — use it when

diagnosing failures.

Project plugins and private skills

The CLI exposes only the server allowlist of project plugins:

• `SUPERUN_CLOUD`
• `SUPERUN_AI`
• `SUPERUN_MANAGED_AGENT_V2`
• `SUPERUN_STORAGE`
• `TTS`
• `ASR`
• `VIDEO_GENERATE`
• `NANO_BANANA`
• `OCR`

Use `sxq plugin list` or `sxq plugin status [pluginId]` to inspect them. `sxq plugin enable <pluginId>` waits for the remote integration lifecycle and, after success, installs its private skills. `sxq plugin disable <pluginId>` may also disable dependent plugins and requires interactive confirmation.

Plugin skills are private, plugin-owned resources rather than the general Superun skill catalog. When an agent needs one, it must run `sxq plugin skill <pluginId>` itself. The command force-upgrades a